From turnbull.stephen.fw at u.tsukuba.ac.jp Mon Aug 1 01:42:36 2016 From: turnbull.stephen.fw at u.tsukuba.ac.jp (Stephen J. Turnbull) Date: Mon, 1 Aug 2016 14:42:36 +0900 Subject: [Overload-sig] where does everything sit? In-Reply-To: References: <20160729163513.783329dc.barry@wooz.org> Message-ID: <22430.57676.841180.405442@turnbull.sk.tsukuba.ac.jp> Guido van Rossum writes: > I'm curious why MM3 doesn't let you log in with email and password > directly? What benefit did Mozilla's service have? Was it just that > Mozilla handled password security? That's the basic rationale. Mailman core's security is still dependent on host security and not exposing control protocols to the network, so the more aspects of user authentication and authorization we can delegate to a service created and maintained by security experts the better. This also allows us to avoid maintaining such critical services in multiple places (Postorius and HyperKitty for now). Use of Persona seemed to allow us to depend on such expertise for both single-sign-on (via Google or whatever) and password authentication. Steve From barry at python.org Mon Aug 1 10:18:45 2016 From: barry at python.org (Barry Warsaw) Date: Mon, 1 Aug 2016 10:18:45 -0400 Subject: [Overload-sig] where does everything sit? In-Reply-To: References: <20160729163513.783329dc.barry@wooz.org> Message-ID: <20160801101845.3e0d02cf@anarchist.wooz.org> On Jul 31, 2016, at 05:54 PM, Guido van Rossum wrote: >OK, thanks! I am anxious to see this list migrated to MM3 -- it's just >a small number of us and the point of the list is mostly to see new >tools in action -- if the transition is a bit rocky that's fine, there >are only a handful of us. +1 - Mark should JFDI when he gets back online. >I'm curious why MM3 doesn't let you log in with email and password >directly? What benefit did Mozilla's service have? Was it just that >Mozilla handled password security? Persona was essentially an email-based single sign-on system. It was a perfect match for Mailman because they only thing you had to prove was that you controlled your email address - exactly (and essentially *only*) the thing that Mailman cares about. It also had the nice property of being distributed; persona.org was one common provider anybody could use, but you could run your own Persona service for your domain if you wanted. It's too bad that it just didn't catch on. I remember talking to Dan Callahan about the whys of that at Pycon 2015, but I don't remember much of the details. The software of course is open source, but I doubt anybody will pick it up so both the service and project are effectively defunct. Cheers, -Barry -------------- next part -------------- A non-text attachment was scrubbed... Name: not available Type: application/pgp-signature Size: 819 bytes Desc: OpenPGP digital signature URL: From barry at python.org Mon Aug 1 10:22:29 2016 From: barry at python.org (Barry Warsaw) Date: Mon, 1 Aug 2016 10:22:29 -0400 Subject: [Overload-sig] Testing the MM3 overload-sig In-Reply-To: References: <20160801004942.29022.26869@mail.python.org> Message-ID: <20160801102229.5ab6ec87.barry@wooz.org> On Jul 31, 2016, at 05:51 PM, Guido van Rossum wrote: >Interesting. I sent this through the MM3 web UI, but apparently what >that form does is just send email to overload-sig at python.org, which is >routed to the MM2 instance. Oh well. Now I know. I just tried playing with the test list and I noticed a misconfiguration, which I've forwarded to postmasters. I know Mark is away for a bit so this may take a little bit to get resolved. The other interesting thing is that it *is* possible to post messages to a mailing list through the REST API (and command line FWIW); it doesn't have to go through the LMTP/SMTP interface. I actually thought that HyperKitty (i.e. through-the-web) posts would use the REST API but it apparently doesn't, leading to the misconfiguration delivery failure I noticed. I'll have to ask the HK folks why that is. Cheers, -Barry From skip.montanaro at gmail.com Mon Aug 1 10:46:54 2016 From: skip.montanaro at gmail.com (Skip Montanaro) Date: Mon, 1 Aug 2016 09:46:54 -0500 Subject: [Overload-sig] Gmane may be shutting down In-Reply-To: References: Message-ID: On Thu, Jul 28, 2016 at 12:48 PM, Brett Cannon wrote: > > Looks like the maintainer is burning out: https://lars.ingebrigtsen.no/2016/07/28/the-end-of-gmane/ That is strange. I just got a positive email reply from him a few days ago in response to my query about creating a couple read-only Gmane mirrors for some defunct bike-related mailing lists which aren't currently visible to search engine crawlers. Skip From mark at msapiro.net Mon Aug 1 21:13:01 2016 From: mark at msapiro.net (Mark Sapiro) Date: Mon, 1 Aug 2016 18:13:01 -0700 Subject: [Overload-sig] where does everything sit? In-Reply-To: <20160801101845.3e0d02cf@anarchist.wooz.org> References: <20160729163513.783329dc.barry@wooz.org> <20160801101845.3e0d02cf@anarchist.wooz.org> Message-ID: On 08/01/2016 07:18 AM, Barry Warsaw wrote: > On Jul 31, 2016, at 05:54 PM, Guido van Rossum wrote: > >> OK, thanks! I am anxious to see this list migrated to MM3 -- it's just >> a small number of us and the point of the list is mostly to see new >> tools in action -- if the transition is a bit rocky that's fine, there >> are only a handful of us. > > +1 - Mark should JFDI when he gets back online. I'm not off line until Friday. I'll do it tomorrow. -- Mark Sapiro The highway is for gamblers, San Francisco Bay Area, California better use your sense - B. Dylan -------------- next part -------------- A non-text attachment was scrubbed... Name: signature.asc Type: application/pgp-signature Size: 181 bytes Desc: OpenPGP digital signature URL: